Applies to: the Sartia mobile app for iOS and Android

Privacy Policy

Effective Date: 4 August 2026 · Last Updated: 5 August 2026

1. Introduction and Scope

Exerevno Limited ("Exerevno", "we", "us", or "our") operates Sartia, a personal color analysis app for iOS and Android (the "App" or the "Service"). Sartia is built by Exer-labs, the product studio of Exerevno Limited.

This Privacy Policy explains what personal information the App collects, how we use and protect it, how long we keep it, and the rights you have in respect of it. It should be read alongside our Terms of Use.

The short version. Sartia analyses a photo of your face to work out your color season. Your photo is used only to create your result and is deleted within 24 hours (immediately after a successful analysis in normal operation), unless you turn on the optional retention setting. We never use your photo or your results to train AI models, and we never sell or share your personal information for advertising. We keep your color results, not your photo.

By using the App you acknowledge that you have read and understood this Privacy Policy. The analysis of your photo happens only after you give explicit, separate consent on the consent screen shown before your first analysis.

2. Who We Are and Our Role

Exerevno Limited acts as the data controller for personal information processed through Sartia. Our contact details are in Section 13.

If you are in the European Economic Area ("EEA"), the United Kingdom, or Switzerland, Exerevno Limited is the controller responsible for your personal data under the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and applicable national legislation (including the UK Data Protection Act 2018).
If you are in New Zealand, Exerevno Limited is an "agency" within the meaning of the Privacy Act 2020 (NZ) ("NZ Privacy Act") and is responsible for compliance with the Information Privacy Principles in that Act.
If you are in Australia, we handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
If you are a California resident, Exerevno Limited is a "business" within the meaning of the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act ("CCPA/CPRA").

3. Information We Collect

What	Why we collect it	How long we keep it
Your face photo	To produce your personal color result. This is the only image we ever handle.	Deleted within 24 hours by default, and immediately after a successful analysis in normal operation. Kept only if you turn on the optional retention setting, until you delete it or delete your account.
Onboarding quiz answers (style goal, color frustration, warm or cool confidence, self-reported natural hair and eye color, occasions, shopping frequency, age range)	To personalise your analysis and guidance. Your self-reported hair and eye color feed the analysis.	While your account is active. If you never create an account by purchasing, these are purged automatically 30 days after collection.
Email address captured at the end of the quiz, before any purchase	To deliver your color profile and, only with your consent, to send you offers.	Same as quiz answers: 30 days if you do not create an account, otherwise while your account is active.
Account email and sign-in identifiers (including your Google or Apple sign-in subject and session tokens)	To create and secure your account and log you in.	While your account is active.
Derived color measurements and your season result (skin, eye, and hair color values, undertone, contrast level, season, confidence)	These are your saved report. They are non-image values and cannot be used to reconstruct your face.	While your account is active.
Facial structure descriptors (Style+ subscribers only)	To tailor style guidance to your features. We store qualitative descriptors only, never landmark coordinates or any template that could re-identify you.	While your account is active.
Purchase and subscription records (amount, currency, status, store and RevenueCat identifiers, entitlement state)	To unlock what you have paid for and to keep our financial records.	While your account is active, and afterwards only where tax and accounting law requires, in minimal form.
An anonymous token generated by our server and stored on your device	To tie your quiz, photo, and result together before you have an account. It is a random token, not a device fingerprint and not an advertising identifier.	Until it is migrated to your account, or purged with the anonymous data at 30 days.
Operational and error logs	To keep the Service working and diagnose faults.	A short rolling window. Logs never contain your photo or any reversible biometric data.

3.1 What We Do Not Collect

We do not collect or see your card details. Purchases are handled entirely by the Apple App Store or Google Play purchase sheet.
We do not use advertising identifiers (IDFA, GAID, or equivalent), do not serve advertisements, and include no third-party advertising, analytics, or behavioural-tracking SDKs in the App.
We do not collect your precise location.
We do not track you across other apps or websites.
The App requests only two device permissions, camera and photo library, and only when you reach the capture step. It does not use the microphone.

4. Legal Bases for Processing (GDPR / UK GDPR)

For users in the EEA, UK, or Switzerland, we rely on the following legal bases:

Processing Activity	Legal Basis
Processing your face photo and deriving your color and facial structure results	Explicit consent (Article 6(1)(a) and Article 9(2)(a)), given on the consent screen shown before your first analysis. No photo is captured or uploaded before you accept.
Collecting your email at the end of the quiz and sending you your color profile	Consent (Article 6(1)(a)) given at the email capture screen, with the purpose stated on that screen.
Marketing email	Consent (Article 6(1)(a)), recorded separately. Every message includes an unsubscribe link.
Creating and running your account, and delivering what you purchased	Contract (Article 6(1)(b)).
Keeping financial and tax records	Legal obligation (Article 6(1)(c)).
Securing the Service, rate limiting, and diagnosing faults	Legitimate interests (Article 6(1)(f)): keeping the Service available, safe, and free from abuse.

Consent is granular and never pre-ticked. You can withdraw it at any time: turn photo retention off to delete a retained photo, unsubscribe from marketing email, or delete your account entirely (see Section 9 and our account deletion page). Withdrawing consent is as easy as giving it. If the consent text materially changes, we ask you to consent again before your next analysis.

5. The Photo Lifecycle

This is the part people most want to understand, so here it is in full:

You accept the analysis consent screen. Nothing is captured before this.
You take a selfie or choose a photo from your library.
The App requests a single-use, short-lived upload link (valid for roughly 60 to 120 seconds) scoped to one file in a private storage bucket. The bucket is never publicly readable.
Our server-side analysis function reads the photo, sends it to our vision model provider solely to produce your result, and writes back only non-image derived values (color measurements, season, confidence, and for Style+ subscribers, qualitative facial structure descriptors).
The photo is deleted. In normal operation this happens immediately after a successful analysis, and a scheduled sweep guarantees removal within 24 hours for anything left behind.
If you turned on the optional retention setting, the photo is kept on your account instead, so you can rerun or compare later, until you turn the setting off, delete the photo, or delete your account.

The only literal image we handle is transient. Everything we retain is a derived measurement that cannot reconstruct your face.

6. No Training, No Sale

We do not use your photos, derived measurements, or results to train, fine-tune, or improve any AI model. Your photo is sent to a server-side vision function solely to produce your own result. We use the vision provider's paid API tier, which does not train on submitted content.
We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising. This has been true for every period since the App launched.
Do Not Sell or Share My Personal Information: we do not sell or share your personal information, so there is nothing to opt out of. We state it here because California law expects the notice regardless.

7. Who We Share Information With

We share information only with the service providers listed below, each acting as a processor on our instructions, and where required by law.

Provider	Purpose	Privacy Policy
Supabase	Hosting, database, private photo storage, authentication, and the server-side functions that run the analysis	supabase.com/privacy
Google LLC (Gemini API, paid tier)	The vision model that analyses your photo to produce your result. Paid-tier content is not used to train Google's models.	policies.google.com/privacy
RevenueCat, Inc.	Subscription status and store receipt validation. No card data.	revenuecat.com/privacy
Apple (App Store) and Google (Google Play)	Payment processing, subscription billing, and app distribution. Your payment details are given to the store, never to us.	apple.com/legal/privacy · policies.google.com/privacy

We may also disclose information if required by law, court order, or a governmental authority, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Exerevno Limited, our users, or the public. In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred to the successor entity, and we will notify you of any new privacy policy that applies.

8. Retention

Photos: deleted within 24 hours by default, or kept until you remove them if you opted in to retention.
Quiz answers, captured email, and results collected before you create an account: purged automatically 30 days after collection. If you purchase within that window, they are migrated to your account and follow the rules below.
Your results, palettes, and profile: kept while your account is active, because the saved report is the product.
After you delete your account: your personal data is fully deleted within 30 days, and in practice the in-app deletion removes it immediately (see Section 9).
Financial records: retained only where and for as long as tax and accounting law requires, in minimal or de-identified form where possible.
Logs: a short rolling window, never containing your photo.

9. Your Rights

We honour the strongest applicable standard across all our markets rather than running different flows per country.

Access and know: you can view your stored data in the App.
Correction: profile fields are editable, and rerunning your analysis replaces a stale result.
Deletion and erasure: the App has an in-app Delete account control. See our account deletion page for the exact steps and for the email route if you can no longer sign in.
Withdraw consent: turn photo retention off, unsubscribe from marketing email, or delete your account.
Portability and objection: if you are covered by the GDPR or UK GDPR you also have the rights to data portability, restriction of processing, and objection to processing based on legitimate interests. Contact us using the details in Section 13 and we will action the request.
Opt out of sale or sharing (CCPA/CPRA): we do not sell or share personal information, and we do not discriminate against you for exercising any right.

We verify rights requests through your own signed-in session so that we act only on the account holder's request. We respond without undue delay and within one month, the strictest window that applies to us, extendable by two further months for complex requests under Article 12(3) GDPR.

You may also complain to your local supervisory authority: in the EEA see edpb.europa.eu, in the UK the Information Commissioner's Office (ico.org.uk), in New Zealand the Office of the Privacy Commissioner (privacy.org.nz), and in Australia the Office of the Australian Information Commissioner (oaic.gov.au).

10. International Data Transfers

Our processors operate outside some users' countries of residence, including in the United States. By using the App you acknowledge that your information may be transferred to and processed in jurisdictions with different data-protection laws than your own.

Transfers from the EEA, UK, or Switzerland: where personal data is transferred to a country without an adequacy decision, we rely on each provider's appropriate safeguards, including the European Commission's Standard Contractual Clauses (2021/914) and the UK International Data Transfer Addendum, as published by that provider.

Transfers from New Zealand: we comply with Information Privacy Principle 12 of the NZ Privacy Act, including by selecting providers whose terms ensure comparable safeguards.

11. Children

Sartia is for users aged 16 and over and is not directed to children under 16. You confirm your age when you accept the analysis consent screen. If we learn that we hold information from someone under 16, we delete it. If you believe a person under 16 has used the App, contact us at hyon.shim@exerevno.co.nz.

Sartia is for analysing your own appearance. Do not upload a photo of another person unless that person has agreed to be analysed. You are responsible for having that person's consent.

12. Security

Encryption in transit: all traffic between the App, our servers, and every processor uses HTTPS/TLS. There is no plaintext transport.
Private photo storage: photos are uploaded through single-use, short-lived signed links into a private bucket that is never publicly readable. Only our server-side functions can read them.
Row level security: every table holding user data enforces that you can only read your own rows. Entitlement records are written only by our server-side functions.
Server-side secrets: the vision provider key, the RevenueCat webhook secret, and our privileged database key exist only in the server environment and are never shipped inside the App.
Abuse and cost protection: the analysis endpoints are rate limited per account and per network address.
Webhook verification: subscription webhooks are verified against a shared secret and processed idempotently, so replays cannot grant entitlements twice.
Input validation: uploads are constrained by type and size, and model output is schema validated before anything is written to the database.
No sensitive data in logs or URLs: photos and reversible biometric data are never logged, and personal data is never placed in a query string.

No method of electronic transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee absolute security. If a notifiable breach occurs we follow the applicable rules in each jurisdiction, including the NZ Privacy Act 2020 notifiable privacy breach scheme, the Australian Notifiable Data Breaches scheme, and the GDPR's 72-hour supervisory authority notification requirement.

13. Contact Us

For any question, concern, or request relating to this Privacy Policy or your personal information, please contact us:

Exerevno Limited
13/30 Upper Queen St, Auckland 1010, New Zealand
Email: hyon.shim@exerevno.co.nz
Website: www.exerevno.co.nz

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above and, where changes are material, take reasonable steps to notify you in the App. Where a change materially affects the consent you gave for photo analysis, we will ask you to consent again before your next analysis.